https://issues.shibboleth.net/jira/browse/SSPCPP-606
[shibboleth/cpp-sp.git] / shibboleth.spec.in
1 Name:           shibboleth
2 Version:        @PACKAGE_VERSION@
3 Release:        1
4 Summary:        Open source system for attribute-based Web SSO
5 Group:          Productivity/Networking/Security
6 Vendor:         Shibboleth Consortium
7 License:        Apache 2.0
8 URL:            http://shibboleth.net/
9 Source:         %{name}-sp-%{version}.tar.gz
10 BuildRoot:      %{_tmppath}/%{name}-sp-%{version}-root
11 Obsoletes:      shibboleth-sp = 2.5.0
12 Requires:       openssl
13 %if 0%{?rhel} >= 6 || 0%{?centos_version} >= 600
14 PreReq:         xmltooling-schemas%{?_isa} >= 1.5.0, opensaml-schemas%{?_isa} >= 2.5.0
15 %else
16 PreReq:         xmltooling-schemas >= 1.5.0, opensaml-schemas >= 2.5.0
17 %endif
18 %if 0%{?suse_version} > 1030 && 0%{?suse_version} < 1130
19 PreReq:         %{insserv_prereq} %{fillup_prereq}
20 BuildRequires:  libXerces-c-devel >= 2.8.0
21 %else
22 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
23 BuildRequires:  xerces-c-devel >= 2.8.0
24 %else
25 BuildRequires:  libxerces-c-devel >= 2.8.0
26 %endif
27 %endif
28 BuildRequires:  libxml-security-c-devel >= 1.4.0
29 BuildRequires:  libxmltooling-devel >= 1.5.0
30 BuildRequires:  libsaml-devel >= 2.5.0
31 %{?_with_log4cpp:BuildRequires: liblog4cpp-devel >= 1.0}
32 %{!?_with_log4cpp:BuildRequires: liblog4shib-devel >= 1.0.4}
33 %if 0%{?rhel} >= 6 || 0%{?centos_version} >= 600
34 Requires:       libcurl-openssl%{?_isa} >= 7.21.7
35 BuildRequires:  chrpath
36 %endif
37 %if 0%{?suse_version} > 1300
38 BuildRequires: libtool
39 %endif
40 BuildRequires:  gcc-c++, zlib-devel, boost-devel >= 1.32.0
41 %{!?_without_gssapi:BuildRequires: krb5-devel}
42 %{!?_without_doxygen:BuildRequires: doxygen}
43 %{!?_without_odbc:BuildRequires:unixODBC-devel}
44 %{?_with_fastcgi:BuildRequires: fcgi-devel}
45 %if 0%{?centos_version} >= 600
46 BuildRequires:  libmemcached-devel
47 %endif
48 %{?_with_memcached:BuildRequires: libmemcached-devel}
49 %if "%{_vendor}" == "redhat"
50 %if 0%{?rhel} >= 6 || 0%{?centos_version} >= 600
51 %{!?_without_builtinapache:BuildRequires: httpd-devel%{?_isa}}
52 %else
53 %{!?_without_builtinapache:BuildRequires: httpd-devel}
54 %endif
55 BuildRequires: redhat-rpm-config
56 Requires(pre): shadow-utils
57 Requires(post): chkconfig
58 Requires(preun): chkconfig, initscripts
59 %endif
60 %if "%{_vendor}" == "suse"
61 Requires(pre): pwdutils
62 %{!?_without_builtinapache:BuildRequires: apache2-devel}
63 %endif
64
65 %define runuser shibd
66 %if "%{_vendor}" == "suse"
67 %define pkgdocdir %{_docdir}/shibboleth
68 %else
69 %define pkgdocdir %{_docdir}/shibboleth-%{version}
70 %endif
71
72 %description
73 Shibboleth is a Web Single Sign-On implementations based on OpenSAML
74 that supports multiple protocols, federated identity, and the extensible
75 exchange of rich attributes subject to privacy controls.
76
77 This package contains the Shibboleth Service Provider runtime libraries,
78 daemon, default plugins, and Apache module(s).
79
80 %package devel
81 Summary:        Shibboleth Development Headers
82 Group:          Development/Libraries/C and C++
83 Requires:       %{name} = %{version}-%{release}
84 Obsoletes:      shibboleth-sp-devel = 2.5.0
85 %if 0%{?suse_version} > 1030 && 0%{?suse_version} < 1130
86 Requires:       libXerces-c-devel >= 2.8.0
87 %else
88 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
89 Requires:  xerces-c-devel >= 2.8.0
90 %else
91 Requires:       libxerces-c-devel >= 2.8.0
92 %endif
93 %endif
94 Requires:       libxml-security-c-devel >= 1.4.0
95 Requires:       libxmltooling-devel >= 1.5.0
96 Requires:       libsaml-devel >= 2.5.0
97 %{?_with_log4cpp:Requires: liblog4cpp-devel >= 1.0}
98 %{!?_with_log4cpp:Requires: liblog4shib-devel >= 1.0.4}
99
100 %description devel
101 Shibboleth is a Web Single Sign-On implementations based on OpenSAML
102 that supports multiple protocols, federated identity, and the extensible
103 exchange of rich attributes subject to privacy controls.
104
105 This package includes files needed for development with Shibboleth.
106
107 %prep
108 %setup -n %{name}-sp-%{version}
109
110 %build
111 %if 0%{?centos_version} >= 600
112         %configure %{?_without_odbc:--disable-odbc} %{?_without_adfs:--disable-adfs} %{?_with_fastcgi} %{!?_without_gssapi:--with-gssapi} %{!?_without_memcached:--with-memcached} %{?shib_options}
113 %else
114         %configure %{?_without_odbc:--disable-odbc} %{?_without_adfs:--disable-adfs} %{?_with_fastcgi} %{!?_without_gssapi:--with-gssapi} %{?_with_memcached} %{?shib_options}
115 %endif
116 %{__make} pkgdocdir=%{pkgdocdir}
117
118 %install
119 %{__make} install NOKEYGEN=1 DESTDIR=$RPM_BUILD_ROOT pkgdocdir=%{pkgdocdir}
120
121 %if "%{_vendor}" == "suse"
122         %{__sed} -i "s/\/var\/log\/httpd/\/var\/log\/apache2/g" \
123                 $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/native.logger
124 %endif
125
126 # Plug the SP into the built-in Apache on a recognized system.
127 touch rpm.filelist
128 APACHE_CONFIG="no"
129 if [ -f $RPM_BUILD_ROOT%{_libdir}/shibboleth/mod_shib_13.so ] ; then
130         APACHE_CONFIG="apache.config"
131 fi
132 if [ -f $RPM_BUILD_ROOT%{_libdir}/shibboleth/mod_shib_20.so ] ; then
133         APACHE_CONFIG="apache2.config"
134 fi
135 if [ -f $RPM_BUILD_ROOT%{_libdir}/shibboleth/mod_shib_22.so ] ; then
136         APACHE_CONFIG="apache22.config"
137 fi
138 if [ -f $RPM_BUILD_ROOT%{_libdir}/shibboleth/mod_shib_24.so ] ; then
139         APACHE_CONFIG="apache24.config"
140 fi
141 %{?_without_builtinapache:APACHE_CONFIG="no"}
142 if [ "$APACHE_CONFIG" != "no" ] ; then
143         APACHE_CONFD="no"
144         if [ -d %{_sysconfdir}/httpd/conf.d ] ; then
145                 APACHE_CONFD="%{_sysconfdir}/httpd/conf.d"
146         fi
147         if [ -d %{_sysconfdir}/apache2/conf.d ] ; then
148                 APACHE_CONFD="%{_sysconfdir}/apache2/conf.d"
149         fi
150         if [ "$APACHE_CONFD" != "no" ] ; then
151                 %{__mkdir} -p $RPM_BUILD_ROOT$APACHE_CONFD
152                 %{__cp} -p $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/$APACHE_CONFIG $RPM_BUILD_ROOT$APACHE_CONFD/shib.conf 
153                 echo "%config(noreplace) $APACHE_CONFD/shib.conf" >> rpm.filelist
154         fi
155 fi
156
157 # Establish location of sysconfig file, if any.
158 SYSCONFIG_SHIBD="no"
159 %if "%{_vendor}" == "redhat"
160         %{__mkdir} -p $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig
161         echo "%config(noreplace) %{_sysconfdir}/sysconfig/shibd" >> rpm.filelist
162         SYSCONFIG_SHIBD="$RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/shibd"
163 %endif
164 %if "%{_vendor}" == "suse"
165         %{__mkdir} -p $RPM_BUILD_ROOT%{_localstatedir}/adm/fillup-templates
166         echo "%{_localstatedir}/adm/fillup-templates/sysconfig.shibd" >> rpm.filelist
167         SYSCONFIG_SHIBD="$RPM_BUILD_ROOT%{_localstatedir}/adm/fillup-templates/sysconfig.shibd"
168 %endif
169 if [ "$SYSCONFIG_SHIBD" != "no" ] ; then
170         # Populate the sysconfig file.
171         cat > $SYSCONFIG_SHIBD <<EOF
172 # Shibboleth SP init script customization
173
174 # User account for shibd
175 SHIBD_USER=%{runuser}
176 EOF
177         %if 0%{?rhel} >= 6 || 0%{?centos_version} >= 600
178                 cat >> $SYSCONFIG_SHIBD <<EOF
179
180 # Override OS-supplied libcurl
181 export LD_LIBRARY_PATH=/opt/shibboleth/%{_lib}
182 EOF
183                 # Strip existing rpath to libcurl.
184                 chrpath -d $RPM_BUILD_ROOT%{_sbindir}/shibd
185                 chrpath -d $RPM_BUILD_ROOT%{_bindir}/mdquery
186                 chrpath -d $RPM_BUILD_ROOT%{_bindir}/resolvertest
187         %endif
188 fi
189
190 %if "%{_vendor}" == "redhat" || "%{_vendor}" == "suse"
191         # %{_initddir} not yet in RHEL5, use deprecated %{_initrddir}
192         install -d -m 0755 $RPM_BUILD_ROOT%{_initrddir}
193         install -m 0755 $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/shibd-%{_vendor} $RPM_BUILD_ROOT%{_initrddir}/shibd
194 %if "%{_vendor}" == "suse"
195         install -d -m 0755 $RPM_BUILD_ROOT/%{_sbindir}
196         %{__ln_s} -f %{_initrddir}/shibd $RPM_BUILD_ROOT%{_sbindir}/rcshibd
197 %endif
198 %endif
199
200 %check
201 %{__make} check
202
203 %clean
204 [ "$RPM_BUILD_ROOT" != "/" ] && %{__rm} -rf $RPM_BUILD_ROOT
205
206 %pre
207 getent group %{runuser} >/dev/null || groupadd -r %{runuser}
208 getent passwd %{runuser} >/dev/null || useradd -r -g %{runuser} \
209         -d  %{_localstatedir}/run/shibboleth -s /sbin/nologin -c "Shibboleth SP daemon" %{runuser}
210 exit 0
211
212 %post
213 %ifnos solaris2.8 solaris2.9 solaris2.10 solaris2.11
214 /sbin/ldconfig
215 %endif
216
217 # Key generation or ownership fix
218 cd %{_sysconfdir}/shibboleth
219 if [ -f sp-key.pem ] ; then
220         %{__chown} %{runuser}:%{runuser} sp-key.pem sp-cert.pem 2>/dev/null || :
221 else
222         sh ./keygen.sh -b -u %{runuser} -g %{runuser}
223 fi
224
225 # Fix ownership of log files (even on new installs, if they're left from an older one).
226 %{__chown} %{runuser}:%{runuser} %{_localstatedir}/log/shibboleth/* 2>/dev/null || :
227
228 %if "%{_vendor}" == "redhat"
229         if [ "$1" -gt "1" ] ; then
230                 # On Red Hat with shib.conf installed, clean up old Alias commands
231                 # by pointing them at new version-independent /usr/share/share tree.
232                 # Any Aliases we didn't create we assume are custom files.
233                 # This is to accomodate making shib.conf a noreplace config file.
234                 # We can't do this for SUSE, because they disallow changes to
235                 # packaged files in scriplets.
236                 APACHE_CONF="no"
237                 if [ -f %{_sysconfdir}/httpd/conf.d/shib.conf ] ; then
238                         APACHE_CONF="%{_sysconfdir}/httpd/conf.d/shib.conf"
239                 fi
240                 if [ "$APACHE_CONF" != "no" ] ; then
241                         %{__sed} -i "s/\/usr\/share\/doc\/shibboleth\(\-\(.\)\{1,\}\)\{0,1\}\/main\.css/\/usr\/share\/shibboleth\/main.css/g" \
242                                 $APACHE_CONF
243                         %{__sed} -i "s/\/usr\/share\/doc\/shibboleth\(\-\(.\)\{1,\}\)\{0,1\}\/logo\.jpg/\/usr\/share\/shibboleth\/logo.jpg/g" \
244                                 $APACHE_CONF
245                 fi
246         fi
247
248         # This adds the proper /etc/rc*.d links for the script
249         /sbin/chkconfig --add shibd
250 %endif
251 %if "%{_vendor}" == "suse"
252         # This adds the proper /etc/rc*.d links for the script
253         # and populates the sysconfig/shibd file.
254         cd /
255         %{fillup_only -n shibd}
256         %insserv_force_if_yast shibd
257 %endif
258
259 %preun
260 # On final removal, stop shibd and remove service, restart Apache if running.
261 %if "%{_vendor}" == "redhat"
262         if [ "$1" -eq 0 ] ; then
263                 /sbin/service shibd stop >/dev/null 2>&1
264                 /sbin/chkconfig --del shibd
265                 %{!?_without_builtinapache:/etc/init.d/httpd status 1>/dev/null && /etc/init.d/httpd restart 1>/dev/null}
266         fi
267 %endif
268 %if "%{_vendor}" == "suse"
269         %stop_on_removal shibd
270         if [ "$1" -eq 0 ] ; then
271                 %{!?_without_builtinapache:/etc/init.d/apache2 status 1>/dev/null && /etc/init.d/apache2 restart 1>/dev/null}
272         fi
273 %endif
274 exit 0
275
276 %postun
277 %ifnos solaris2.8 solaris2.9 solaris2.10 solaris2.11
278 /sbin/ldconfig
279 %endif
280 %if "%{_vendor}" == "redhat"
281         # On upgrade, restart components if they're already running.
282         if [ "$1" -ge "1" ] ; then
283                 /etc/init.d/shibd status 1>/dev/null && /etc/init.d/shibd restart 1>/dev/null
284                 %{!?_without_builtinapache:/etc/init.d/httpd status 1>/dev/null && /etc/init.d/httpd restart 1>/dev/null}
285                 exit 0
286         fi
287 %endif
288 %if "%{_vendor}" == "suse"
289         cd / 
290         %restart_on_update shibd
291         %{!?_without_builtinapache:%restart_on_update apache2}
292         %{insserv_cleanup}
293 %endif
294
295 %posttrans
296 # ugly hack if init script got removed during %postun by upgraded (buggy/2.1) package
297 %if "%{_vendor}" == "redhat"
298         if [ ! -f %{_initrddir}/shibd ] ; then
299                 if [ -f %{_sysconfdir}/shibboleth/shibd-%{_vendor} ] ; then
300                         %{__cp} -p %{_sysconfdir}/shibboleth/shibd-%{_vendor} %{_initrddir}/shibd
301                         %{__chmod} 755 %{_initrddir}/shibd
302                         /sbin/chkconfig --add shibd
303         fi
304 fi
305 %endif
306
307 %files -f rpm.filelist
308 %defattr(-,root,root,-)
309 %{_sbindir}/shibd
310 %{_bindir}/mdquery
311 %{_bindir}/resolvertest
312 %{_libdir}/libshibsp.so.*
313 %{_libdir}/libshibsp-lite.so.*
314 %dir %{_libdir}/shibboleth
315 %{_libdir}/shibboleth/*
316 %attr(0750,%{runuser},%{runuser}) %dir %{_localstatedir}/log/shibboleth
317 %if 0%{?suse_version} > 1300
318 %attr(0755,%{runuser},%{runuser}) %dir %{_localstatedir}/run/shibboleth
319 %endif
320 %attr(0755,%{runuser},%{runuser}) %dir %{_localstatedir}/cache/shibboleth
321 %dir %{_datadir}/xml/shibboleth
322 %{_datadir}/xml/shibboleth/*
323 %dir %{_datadir}/shibboleth
324 %{_datadir}/shibboleth/*
325 %dir %{_sysconfdir}/shibboleth
326 %config(noreplace) %{_sysconfdir}/shibboleth/*.xml
327 %config(noreplace) %{_sysconfdir}/shibboleth/*.html
328 %config(noreplace) %{_sysconfdir}/shibboleth/*.logger
329 %if "%{_vendor}" == "redhat" || "%{_vendor}" == "suse"
330 %config %{_initrddir}/shibd
331 %endif
332 %if "%{_vendor}" == "suse"
333 %{_sbindir}/rcshibd
334 %endif
335 %{_sysconfdir}/shibboleth/*.dist
336 %{_sysconfdir}/shibboleth/apache*.config
337 %{_sysconfdir}/shibboleth/shibd-*
338 %attr(0755,root,root) %{_sysconfdir}/shibboleth/keygen.sh
339 %attr(0755,root,root) %{_sysconfdir}/shibboleth/metagen.sh
340 %{_sysconfdir}/shibboleth/*.xsl
341 %doc %{pkgdocdir}
342 %exclude %{pkgdocdir}/api
343
344 %files devel
345 %defattr(-,root,root,-)
346 %{_includedir}/*
347 %{_libdir}/libshibsp.so
348 %{_libdir}/libshibsp-lite.so
349 %doc %{pkgdocdir}/api
350
351 %changelog
352 * Tue May 13 2014 Ian Young <ian@iay.org.uk> - 2.5.3-1.2
353 - Update package dependencies for RHEL/CentOS 7
354 - Fix bogus dates in changelog
355
356 * Sat Jun 8 2013   Scott Cantor  <cantor.2@osu.edu>  - 2.5.2-1
357 - Add --with-gssapi using MIT K5 by default
358
359 * Tue Sep 25 2012  Scott Cantor  <cantor.2@osu.edu>  - 2.5.1-1
360 - Merge back various changes used in released packages
361 - Prep for 2.5.1 by pulling extra restart out
362
363 * Tue Aug 7 2012  Scott Cantor  <cantor.2@osu.edu>  - 2.5.0-2
364 - Changed package name back to shibboleth because of upgrade bugs
365 - Put back extra restart for this release only.
366
367 * Thu Mar 1 2012  Scott Cantor  <cantor.2@osu.edu>  - 2.5.0-1
368 - Move logo and stylesheet to version-independent tree
369 - Make shib.conf noreplace
370 - Post-fixup of Alias commands in older shib.conf
371 - Changes to run shibd as non-root shibboleth user
372 - Move init customizations to /etc/sysconfig/shibd
373 - Copy shibd restart for Red Hat to postun
374 - Add boost-devel dependency
375 - Build memcache plugin on RH6
376 - Add cachedir to install
377 - Add Apache 2.4 to install
378
379 * Sun Jun 26 2011  Scott Cantor  <cantor.2@osu.edu>  - 2.4.3-1
380 - Log files shouldn't be world readable.
381 - Explicit requirement for libcurl-openssl on RHEL6
382 - Uncomment LD_LIBRARY_PATH in init script for RHEL6 
383 - Remove rpath from binaries for RHEL6
384
385 * Fri Dec 25 2009  Scott Cantor  <cantor.2@osu.edu>  - 2.4-1
386 - Update dependencies.
387
388 * Mon Nov 23 2009 Scott Cantor  <cantor.2@osu.edu>  - 2.3.1-1
389 - Reset revision for 2.3.1 release
390
391 * Wed Aug 19 2009 Scott Cantor  <cantor.2@osu.edu>  - 2.2.1-2
392 - SuSE init script changes
393 - Restart Apache on removal, not just upgrade
394 - Fix scriptlet exit values when Apache is stopped
395
396 * Mon Aug 10 2009 Scott Cantor  <cantor.2@osu.edu>  - 2.2.1-1
397 - Doc handling changes
398 - SuSE init script
399
400 * Tue Aug 4 2009 Scott Cantor  <cantor.2@osu.edu>  - 2.2.1-1
401 - Initial version for 2.2.1, with shibd/httpd restart on upgrade
402
403 * Thu Jun 25 2009 Scott Cantor  <cantor.2@osu.edu>  - 2.2-3
404 - Add additional cleanup to posttrans fix
405
406 * Tue Jun 23 2009 Scott Cantor  <cantor.2@osu.edu>  - 2.2-2
407 - Reverse without_builtinapache macro test
408 - Fix init script handling on Red Hat to handle upgrades
409
410 * Wed Dec 3 2008  Scott Cantor  <cantor.2@osu.edu>  - 2.2-1
411 - Bump minor version.
412 - Make keygen.sh executable.
413 - Fixing SUSE Xerces dependency name.
414 - Optionally package shib.conf.
415
416 * Tue Jun 10 2008  Scott Cantor  <cantor.2@osu.edu>  - 2.1-1
417 - Change shib.conf handling to treat as config file.
418
419 * Mon Mar 17 2008  Scott Cantor  <cantor.2@osu.edu>  - 2.0-6
420 - Official release.
421
422 * Fri Jan 18 2008  Scott Cantor  <cantor.2@osu.edu>  - 2.0-5
423 - Release candidate 1.
424
425 * Sun Oct 21 2007 Scott Cantor  <cantor.2@osu.edu>  - 2.0-4
426 - libexec -> lib/shibboleth changes
427 - Added doc subpackage
428
429 * Thu Aug 16 2007 Scott Cantor  <cantor.2@osu.edu>  - 2.0-3
430 - First public beta.
431
432 * Fri Jul 13 2007 Scott Cantor  <cantor.2@osu.edu>  - 2.0-2
433 - Second alpha release.
434
435 * Sun Jun 10 2007 Scott Cantor  <cantor.2@osu.edu>  - 2.0-1
436 - First alpha release.
437
438 * Mon Oct 2 2006 Scott Cantor   <cantor.2@osu.edu>  - 1.3-11
439 - Applied fix for secadv 20061002
440 - Fix for metadata loader loop
441
442 * Thu Jun 15 2006 Scott Cantor  <cantor.2@osu.edu>  - 1.3-10
443 - Applied fix for sec 20060615
444
445 * Sat Apr 15 2006 Scott Cantor  <cantor.2@osu.edu>  - 1.3-9
446 - Misc. patches, SuSE, Apache 2.2, gcc 4.1, and 64-bit support
447
448 * Mon Jan 9 2006 Scott Cantor  <cantor.2@osu.edu>  - 1.3-8
449 - Applied new fix for secadv 20060109
450
451 * Tue Nov 8 2005 Scott Cantor  <cantor.2@osu.edu>  - 1.3-7
452 - Applied new fix for secadv 20050901 plus rollup
453
454 * Fri Sep 23 2005 Scott Cantor  <cantor.2@osu.edu>  - 1.3-6
455 - Minor patches and default config changes
456 - pidfile patch
457 - Fix shib.conf creation
458 - Integrated init.d script
459 - Prevent replacement of config files
460
461 * Thu Sep 1 2005  Scott Cantor  <cantor.2@osu.edu>  - 1.3-5
462 - Applied fix for secadv 20050901 plus rollup of NSAPI fixes
463
464 * Sun Apr 24 2005  Scott Cantor  <cantor.2@osu.edu>  - 1.3-1
465 - Updated test programs and location of schemas.
466 - move siterefresh to to sbindir
467
468 * Fri Apr  1 2005  Derek Atkins  <derek@ihtfp.com>  - 1.3-1
469 - Add selinux-targeted-policy package
470 - move shar to sbindir
471
472 * Tue Oct 19 2004  Derek Atkins  <derek@ihtfp.com>  - 1.2-1
473 - Create SPEC file based on various versions in existence.